Easy Entra Integration™

Powered by STFWorks©

The Easy Entra Integration™ is an automated seamless way to keep your Oracle Fusion Applications user accounts synchronized with your Microsoft Azure Entra (Active Directory) service. Once enabled, you can control the synchronization of Employee Names, Phone Numbers, Addresses, Emails, Organization Information, Job Titles and more.

Getting Started

Organizing the setup of the integration takes careful planning. You will need the following information:

ITEM	DESCRIPTION	REQUIREMENTS
Fusion Connection	A valid user account to establish a connection to your Oracle Fusion Applications	Security Roles: Human Resource Manager Human Capital Management Application Administrator Application Implementation Administrator Human Capital Management Integration Specialist PER_HUMAN_RESOURCE_MANAGER_JOB ORA_HRC_HUMAN_CAPITAL_MANAGEMENT_APPLICATION_ADMINISTRATOR_JOB ASM_APPLICATION_IMPLEMENTATION_ADMIN_ABSTRACT ORA_HRC_HUMAN_CAPITAL_MANAGEMENT_INTEGRATION_SPECIALIST_JOB
Azure Entra Connection	Registration of an Application in Microsoft Azure Entra. Optionally use a named user or an application key.	API Permissions: User.ReadWriteAll User-Phone.ReadWrite.All User-Mail.readWrite.All User-EnableDisableAccount.All

See the Preparing Connections (below) section for detailed instructions.

Step 1: Register

When you log into the Easy Entra Integration administration site for the first time, you will be asked to provide contact information.

FIELD	DESCRIPTION
Name	The name of your organization
Contact Email	A primary contact email address
Contact Phone	A primary contact phone number
Create Accounts	Uncheck this if you do not want the integration to register new users in Oracle Fusion with accounts in Azure Entra (AD)
Draft Only	If you check this, the integration will report differences between Oracle Fusion and Azure Entra, but will not make those changes
Default Password	Optionally provide a default password to assign new user accounts created in Azure Entra (AD)

When you save the information, you will receive a confirmation. You will also note there are additional configuration items available for Matching, Mapping, Entra Connection and Fusion Connection.

Step 2: Fusion Connection

Configure the Fusion connection by selecting the Fusion Env tab.

FIELD	DESCRIPTION
Hostname	(Required) This is the hostname for your Fusion environment. It is just fine to paste in a copy of the entire url.
User	(Required) The username of the Fusion account
Password	(Required) The password of the Fusion account

Save the connection.

Use the Validate button to verify a successful connection.

Step 3: Azure Entra (AD) Connection

Configure the Fusion connection by selecting the Entra Env tab.

FIELD	DESCRIPTION
Tenant ID	(Required) The tenant ID from the App registration in the Azure Entra admin center
Application (client) ID	(Required) The Application (client) ID of the App registration
Client Secret	(Option 2) The certificate Client Secret if using certificate access
User	(Option 1) The username of the Azure Entra account if using a named user
Password	(Option 1) The password of the Azure Entra account if using a named user

Save the connection.

Use the Validate button to verify a successful connection.

Complete

At this point, the core setup is complete. In the next four sections we will explore the configuration options available.

· Matching Rules

· Data Mapping

· Synchronization Schedule

· Administrative Users

Easy Entra Integration™

Powered by STFWorks©

Matching Rules

For the Easy Entra Integration to work efficiently, it must be able to match Fusion User accounts with Azure Entra accounts. The matching tab in the configuration console enables you to establish rules for this.

The integration will utilize two of the Azure Entra Extended Attributes to hold the Fusion Person ID and Person Number values. You have the option to choose which of the available Fifteen (15) extension attributes are to be used for this.

Additionally, you have the ability to assign up to 5 additional matching rules.

When the integration is attempting to match accounts, any single rule where the Azure Entra value equals the Oracle Fusion value is required to establish a match.

Data Mappings

The Easy Entra Integration maps fields between Azure Entra and Oracle Fusion based upon the mapping you defined. You have the ability to specify which of the two systems is the “owner” of the data, thereby indicating which system establishes the enterprise value and which system is synced to match that enterprise value.

The default map establishes Oracle Fusion as the “owner” of account enablement, nickname, employee name, display name, work and mobile phones, email address, home address, organization and job titles.

The system enables you to change the ownership of employee name, work and mobile phones, email address and home address.

Synchronization Schedule

The Easy Entra Integration enables you to periodically run the synchronization process on two possible schedules, “Every X Period”, and “Specific Time”. Enabling a schedule is optional, however, without at least one, the synchronization process will have to be launched manually.

Only a schedule where the Enabled checkbox is checked will be active in.

The “Every X Period” schedule will run every X period (minutes, hours, days). So, for example, setting this schedule with

Periodicity	2
Period Type	Hour

Will result in the integration running every 2 hours.

The “Specific Time” schedule will run at a specified day and time. So, for example, setting this schedule with

Month	<blank>
Day	<blank>
Hour	1
Minute	30

Will result in the integration running every Day at 1:30am. (Note: The schedules are time zone aware, so this schedule will run at 1:30am according to the time zone selected).

Administrative User Accounts

The Easy Entra Integration is designed to allow additional administrators access to the configuration. This can be done on the User Accounts tab. Quickly and easily add, disable and delete user access accounts.

Execution History

You have the ability to monitor and review historical synchronization executions of the Easy Entra Integration on the History tab.

Easily search history with the filter conditions and review the run results.

Easy Entra Integration™

Powered by STFWorks©

Creating an account in Oracle Fusion

STEP	DESCRIPTION
1	Log into your Fusion Applications application
2	Create a new user account in Menu  Tools  Security Console
3	Assign and email address and username
4	Assign the following role Human Resource Manager Human Capital Management Application Administrator Application Implementation Administrator Human Capital Management Integration Specialist PER_HUMAN_RESOURCE_MANAGER_JOB ORA_HRC_HUMAN_CAPITAL_MANAGEMENT_APPLICATION_ADMINISTRATOR_JOB ASM_APPLICATION_IMPLEMENTATION_ADMIN_ABSTRACT ORA_HRC_HUMAN_CAPITAL_MANAGEMENT_INTEGRATION_SPECIALIST_JOB

Easy Entra Integration™

Powered by STFWorks©

Registering an Application in Azure Entra (AD)

The Easy Entra Integration requires access to Azure Entra (AD) with a certain amount of administrative privileges. The integration is able to create and disable accounts as well as update account profile information, which requires certain roles.

STEP

DESCRIPTION

1

From the Microsoft Entra admin center under Applications  App Registrations

2

Create a New registration

3

Enter a Display Name for the application (Easy Entra by STFWorks)

4

Specify who can use the application in the Supported account type session

a. Use Accounts in this organization directory only

5

Select Register to complete the initial registration

a. NOTE The: Application (client) ID

b. NOTE The: Directory (tenant) ID

6

On the left ribbon, select Authentication

a. Toggle the Allow public client flows to Yes

7

On the left ribbon, select API Permissions

Add a permission and choose Microsoft Graph

Add the following permissions

User.ReadWriteAll

User-Phone.ReadWrite.All

User-Mail.readWrite.All

User-EnableDisableAccount.All

Click the Grant admin consent

8

On the left ribbon select Expose an API

Click Add a Scope

Provide the Scope Name	STFWorks
Who can consent	Admins Only
Admin Consent Display	STFWorks Easy Entra
State	Enabled

Click the Add Scope button

Registering Access to the Azure Entra

There are two options for granting access to your Azure Entra system:

1. Named User: In this configuration, the integration will run as this user

2. Certificate: In this configuration, the integration will run as a background process

STEP	OPTION 1 – Named User
1	Create a New User
2	Add the following Directory Roles Authentication Administrator User Administrator
3	Log in as the new user and set the initial password VERY IMPORTANT: Do NOT set this user up with multi-factor authentication

STEP	OPTION 2 – Background Process
1	Open the App Registration created above
2	On the left ribbon select Certificates & Secrets
3	Select the Client secrets
4	Click New client secret Description: STFWorks Easy Entra Choose an expiration according to your security policies Click Add VERY IMPORTANT Copy this Value for later, (this will not be shown again)

Easy Entra Integration™

Powered by STFWorks©